💻 computer science

Attack-aware Federated Learning via Prototype-guided Cross-cluster Knowledge Transfer for Label-space Heterogeneous Intrusion Detection

This paper proposes Attack-Fed, a two-level federated learning framework that addresses label-space heterogeneity in intrusion detection by combining attack-aware clustering with prototype-guided cross-cluster knowledge transfer to enable specialized learning while leveraging complementary attack expertise.

Original authors: Marwa Badrouni, Chaker Katar, Wissem Inoubli, Zahra Kodia

Published 2026-10-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Marwa Badrouni, Chaker Katar, Wissem Inoubli, Zahra Kodia

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital age, our networks are constantly under siege. From small home routers to massive industrial systems, malicious actors are always looking for a way in. To catch them, security experts use Intrusion Detection Systems, which act like digital watchdogs, scanning network traffic for signs of trouble. For years, these systems relied on simple lists of known bad behaviors, but as attacks have become smarter and more varied, experts turned to artificial intelligence. These smart systems learn from vast amounts of data to spot new threats automatically. However, a major problem arises when trying to train these systems: the data is scattered. A hospital, a bank, and a factory all have different networks and face different types of attacks, but they cannot simply share their private traffic logs with a central authority due to strict privacy laws and security policies.

Federated learning emerged as a solution to this privacy dilemma. Instead of gathering all the data in one place, this approach sends the learning model to the data. Each organization trains the model locally on its own private information and sends only the learned updates back to a central coordinator, which combines them into a smarter global model. It is a clever way to learn together without ever seeing each other's secrets. Yet, a hidden flaw remains in this collaborative process. In the real world, not every organization sees the same kinds of attacks. One might see thousands of attempts to flood its servers, while another only sees attempts to steal passwords. If the central coordinator blindly mixes the lessons learned from these very different environments, the resulting model can become confused, failing to recognize the specific threats that each organization actually faces.

Researchers Marwa Badrouni, Chaker Katar, Wissem Inoubli, and Zahra Kodia tackled this specific confusion in their study, proposing a new method called Attack-Fed. They recognized that the core issue was not just that data was different, but that the very categories of threats each client knew about were different. To fix this, they designed a two-step process that respects these differences while still allowing for helpful collaboration. First, they created a way for each participant to describe its own "attack expertise" without revealing any private data. They did this by summarizing which families of attacks were present, how often they appeared, and how many different variations of those attacks were seen. Using this summary, the system automatically groups together clients who face similar threats, ensuring that the initial learning happens among partners who speak the same "security language."

However, stopping there would leave valuable knowledge trapped in isolated groups. A client that knows a lot about botnets might have little to teach a client focused on web attacks, but they might still share useful insights about the underlying patterns of malicious behavior. To solve this, the researchers added a second level of interaction. They built a map of relationships between the different groups, identifying which clusters had complementary knowledge. Instead of forcing all groups to merge their entire models, which would cause confusion, they allowed them to exchange specific, compact pieces of knowledge. Think of it as two specialists sharing a single, crucial insight rather than swapping their entire libraries. This exchange is guided by prototypes, which are essentially representative examples of what a specific attack looks like in the system's memory.

The team tested this approach using two large, real-world datasets of network traffic, simulating a scenario where twenty different organizations participated, each seeing only a unique subset of possible attacks. The results were clear and measurable. When they compared their new method against standard approaches that treat all participants the same, the new system performed significantly better. On one dataset, the standard method achieved an F1 score, a measure of accuracy and reliability, of about 80.9 percent. The new method, which grouped clients by their specific attack knowledge and then shared insights selectively, pushed that score up to 91.28 percent. This improvement was not just a small tweak; it represented a substantial leap in the system's ability to detect threats accurately across a diverse network.

The study also revealed that the success came from both parts of their design working together. When they removed the grouping step and let everyone learn together, performance dropped sharply. When they kept the groups but stopped the cross-group sharing, the system improved but did not reach its full potential. The most effective strategy was the combination: grouping clients who faced similar threats to prevent confusion, and then carefully bridging the gaps between groups to share complementary expertise. This approach proved robust even when the differences between the clients' environments were made extreme, suggesting that the method holds up well under difficult conditions. The researchers also noted that while their system required a bit more time to process the initial grouping and sharing steps, the extra time was minimal compared to the gains in security performance.

Ultimately, this work demonstrates that in the complex world of cybersecurity, one size does not fit all. By acknowledging that different networks face different dangers and tailoring the collaboration to match those realities, it is possible to build a stronger, more accurate defense system. The researchers showed that you do not need to sacrifice privacy or ignore the unique nature of each network to benefit from collective intelligence. Instead, by organizing the learning process around the actual threats present and facilitating targeted knowledge exchange, federated learning can evolve from a blunt instrument into a precise and powerful tool for protecting our digital infrastructure.

Technical Summary: Attack-Fed for Label-Space Heterogeneous Intrusion Detection

1. Problem Statement

The paper addresses a critical limitation in Federated Learning (FL) applied to Network Intrusion Detection Systems (NIDS): label-space heterogeneity. In practical cybersecurity environments, distributed clients (e.g., IoT devices, organizational networks) often observe fundamentally different subsets of attack families due to varying network architectures and threat landscapes. Unlike standard statistical heterogeneity (where clients share the same label space but with different class proportions), label-space heterogeneity occurs when client $i$ observes a set of labels $Y_i$ that is not a subset of, nor identical to, client $j$ 's set $Y_j$ ( $Y_i \neq Y_j$ ).

This disparity creates two primary challenges for conventional FL:

Incompatible Aggregation: Directly averaging model updates from clients optimizing different local classification objectives introduces conflicting signals, degrading global performance.
Knowledge Isolation: Existing clustered FL strategies group clients based on model similarity or feature distributions but fail to explicitly characterize the semantic compatibility of their local attack spaces. Consequently, complementary knowledge regarding different attack families may remain isolated within independent clusters, preventing the federation from leveraging diverse expertise.

2. Methodology: Attack-Fed

The authors propose Attack-Fed, a two-level, attack-aware federated learning framework designed to jointly manage attack-space compatibility and complementary knowledge transfer.

Level 1: Attack-Aware Client Clustering

The first level organizes clients into groups based on the compatibility of their local attack expertise rather than generic model similarity.

Attack Category Profile (ACP): Each client constructs a compact, privacy-preserving statistical profile summarizing its local attack knowledge. For each predefined attack family, the ACP captures three descriptors:
- Presence: A binary indicator of whether the attack family is observed.
- Frequency: The proportion of samples belonging to that family.
- Diversity: The variety of specific attack variants observed within the family.
Similarity Measurement: A similarity matrix is computed between clients based on the overlap of their ACPs, focusing on common attack families.
Clustering: The Affinity Propagation (AP) algorithm is applied to this similarity matrix. Unlike K-means, AP does not require a pre-specified number of clusters and automatically identifies representative clients (exemplars). This results in clusters of clients with semantically compatible local label spaces, enabling coherent intra-cluster model aggregation.

Level 2: Prototype-Guided Cross-Cluster Knowledge Transfer

The second level addresses the isolation of complementary knowledge that arises from separating clients into distinct clusters.

Cluster Knowledge Representation: Each cluster summarizes its learned knowledge using attack prototypes (centroids of latent representations for specific attack categories) rather than sharing full model parameters or raw data.
Cluster Relationship Graph (CRG): A graph is constructed where nodes represent clusters and edges represent the strength of relationships between them. Edge weights are determined by the cosine similarity between the prototype sets of different clusters.
Selective Transfer: Knowledge exchange is restricted to connected clusters (those with high prototype similarity). A prototype-guided regularization term is added to the local loss function of each cluster. This term minimizes the distance between local sample embeddings and the most relevant external prototypes from neighboring clusters.
Mechanism: This allows clusters to benefit from complementary attack knowledge (e.g., a cluster specializing in DDoS learning from a cluster specializing in Botnets if their representations are semantically related) without forcing them to adopt new classification labels or merge their distinct label spaces.

3. Key Contributions

The paper outlines five primary contributions:

Problem Formulation: Explicitly formulates and addresses label-space heterogeneity in federated intrusion detection, where clients optimize different local objectives due to disjoint attack categories.
Attack Category Profile (ACP): Introduces a novel representation capturing client expertise via presence, frequency, and diversity of attack families, used to construct a semantic similarity matrix.
Attack-Aware Clustering: Develops an Affinity Propagation-based clustering mechanism that automatically groups clients with compatible attack spaces, facilitating coherent intra-cluster aggregation.
Cross-Cluster Knowledge Transfer: Proposes an Attack Relationship Graph and a prototype-guided propagation mechanism to selectively transfer complementary knowledge across heterogeneous clusters, mitigating knowledge isolation.
Comprehensive Evaluation: Conducts extensive experiments on CIC-IoT-2023 and UNSW-NB15 datasets, including comparative, ablation, and robustness analyses under varying degrees of heterogeneity.

4. Experimental Results

The proposed method was evaluated against baselines including FedAvg, FedProx, FedProto, IFCA, and standard Clustered FL (CFL).

Performance: On the CIC-IoT-2023 dataset with 20 clients, Attack-Fed achieved an F1-score of 91.28%, outperforming the strongest baseline (FedProto at 85.41%) and the ACP-clustering-only variant (88.56%). On UNSW-NB15, it achieved an F1-score of 89.87%.
Impact of Components:
- Clustering: ACP-based clustering alone improved F1 by ~3.15% over FedProto, demonstrating the value of grouping by attack expertise.
- Cross-Cluster Transfer: Adding the knowledge-guided transfer mechanism provided an additional 2.72% absolute gain in F1-score over clustering alone, confirming that selective inter-cluster sharing recovers valuable complementary knowledge.
- Strategy Comparison: Knowledge-guided transfer significantly outperformed random cross-cluster transfer, validating the necessity of semantic relationship modeling.
Robustness: Attack-Fed maintained superior performance as label-space heterogeneity increased from low to high levels, whereas global aggregation methods (FedAvg) suffered significant degradation.
Per-Category Analysis: The method showed particular improvement in detecting rare or localized attack categories (e.g., Botnet, Spooﬁng), where knowledge is concentrated in specific clusters.
Efficiency: While Attack-Fed incurs slightly higher execution time due to clustering and transfer operations (approx. 43 seconds additional on CIC-IoT-2023), it remains practical and converges stably within 100 communication rounds.

5. Significance and Claims

The paper claims that Attack-Fed offers a balanced solution to the trade-off between knowledge isolation and conflicting aggregation. By explicitly modeling the semantic structure of local attack spaces, the framework avoids the pitfalls of indiscriminate global aggregation while preventing the fragmentation of the federation into completely isolated silos.

The authors assert that their approach is significant because:

It moves beyond generic statistical heterogeneity to address the semantic incompatibility of local learning objectives in cybersecurity.
It demonstrates that selective, relationship-guided knowledge transfer is more effective than blind aggregation or complete isolation.
It provides a scalable, privacy-preserving mechanism for collaborative intrusion detection in highly heterogeneous environments, where different clients face different threat landscapes.

The paper concludes by noting that future work will explore dynamic environments with evolving attack categories and more adaptive transfer mechanisms, but currently establishes a robust baseline for handling static label-space heterogeneity in federated NIDS.